Spanning Tree (STP) Cheat Sheet
Command reference for Cisco IOS Spanning Tree Protocol (STP/RSTP) on Catalyst switches: choose the mode, steer the root bridge, tune per-VLAN path cost and port priority, harden edge ports, and verify. Commands are global config unless a row notes (interface) or (EXEC); lowest Bridge ID (priority, then MAC) wins the root election.
Part of the Spanning Tree (STP) learning hub
Mode & root bridge
Set the STP mode, then force or elect the root per VLAN. Bridge priority must be a multiple of 4096 (default 32768).
| Command | What it does |
|---|---|
spanning-tree mode rapid-pvst | Set mode to Rapid PVST+ (per-VLAN RSTP). Alternatives: spanning-tree mode pvst | mst. |
spanning-tree vlan <id> root primary | Macro: lower this switch's priority (to 24576, or 4096 below the current root) so it becomes root for the VLAN(s). One-time; not dynamic. |
spanning-tree vlan <id> root secondary | Macro: set priority 28672 so this switch is the backup root. |
spanning-tree vlan <id> priority <0-61440> | Manually set bridge priority in steps of 4096 (default 32768). Lower value wins the election. |
Port cost & priority (per-VLAN, interface)
Applied under the interface; influences root-port and designated-port selection. Lower cost/priority is preferred.
| Command | What it does |
|---|---|
spanning-tree vlan <id> cost <1-200000000> | Set the interface path cost for the VLAN (default derives from bandwidth). Lowest cumulative cost to root chooses the root port. |
spanning-tree vlan <id> port-priority <0-240> | Set port priority in increments of 16 (default 128). Tie-breaker when path costs are equal; lower wins. |
Edge / port protection
PortFast speeds host ports to forwarding; BPDU Guard and Root Guard defend the topology. Global 'default' forms apply switch-wide.
| Command | What it does |
|---|---|
spanning-tree portfast [edge] | Interface (access port): skip listening/learning so the port forwards immediately. The 'edge' keyword is used on newer IOS/IOS-XE. |
spanning-tree bpduguard enable | Interface: err-disable the port the instant any BPDU is received — protects PortFast edge ports from a rogue switch/loop. |
spanning-tree guard root | Interface: ignore superior BPDUs and put the port in root-inconsistent (blocking) state, keeping the root where you designed it. |
spanning-tree portfast default | Global: enable PortFast automatically on all non-trunk (access) ports. |
spanning-tree portfast bpduguard default | Global: enable BPDU Guard automatically on every PortFast-enabled port. |
Verification (EXEC)
Run from privileged EXEC to confirm root, roles, states, and edge-protection status.
| Command | What it does |
|---|---|
show spanning-tree | All VLANs: root and local bridge IDs, port roles/states, and path costs. |
show spanning-tree vlan <id> | STP details for one VLAN, including whether 'This bridge is the root'. |
show spanning-tree root | Per-VLAN root bridge ID, root path cost, and the local root port toward it. |
show spanning-tree summary | Mode, PortFast/BPDU Guard/Loop Guard defaults, and a count of ports per state. |
show spanning-tree interface <if> detail | Per-port role, state, cost, priority, and BPDU transmit/receive counters. |
Frequently asked questions
What's the difference between 'spanning-tree vlan <id> root primary' and setting the priority by hand?
'root primary' is a one-time macro: IOS reads the current root's priority and sets this switch to 24576 (or 4096 below the current root) so it wins the election right now — it does not keep tracking future changes. 'spanning-tree vlan <id> priority <value>' sets an exact value you manage yourself, which must be a multiple of 4096. Both change the bridge priority, and the lowest Bridge ID (priority first, then MAC) becomes root.
Do I need both PortFast and BPDU Guard on access ports?
Yes, they solve different problems. PortFast skips the listening/learning delay so a host port forwards immediately, but it does nothing if someone plugs a switch into that port and creates a loop. BPDU Guard err-disables the port the moment it receives any BPDU, shutting down that risk. Pair them per-port (spanning-tree portfast + spanning-tree bpduguard enable) or switch-wide (spanning-tree portfast default + spanning-tree portfast bpduguard default).
How do I confirm which switch is the root bridge for a VLAN?
Run 'show spanning-tree vlan <id>' or 'show spanning-tree root'. If the output says 'This bridge is the root,' this switch is the root for that VLAN; otherwise it lists the Root ID, the root path cost, and the local root port pointing toward the root. Remember the lowest priority (then lowest MAC) wins.
Stop memorizing — practice on real Cisco IOS
A cheat sheet gets you unstuck; a graded lab makes it stick. Start with the free sample.